https://cybertoolchain.io/tools/yara New releases and features in YARA, tracked by The Cyber Toolchain. en Tue, 27 Oct 2026 12:10:10 GMT https://github.com/VirusTotal/yara/releases/tag/v4.6.0 https://github.com/VirusTotal/yara/releases/tag/v4.6.0 Tue, 27 Oct 2026 12:10:10 GMT YARA v4.6.0 adds `yr_get_version` for runtime library version detection and nine new `elf.machine` constants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds yr_get_version(int* major, int* minor, int* micro) API to report the version of libyara loaded at runtime, allowing any pointer to be NULL and working before `yr_initialize`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes nine new `elf.machine` named constants in the `elf` module: `EM_PARISC` (15), `EM_SPARC32PLUS` (18), `EM_S390` (22), `EM_MCORE`/`EM_RCE` (39), `EM_SH` (42), `EM_SPARCV9` (43), `EM_ARC_COMPACT` (93), `EM_BPF` (247), and `EM_LOONGARCH` (258), replacing the need to hardcode raw numbers in rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.5.5 https://github.com/VirusTotal/yara/releases/tag/v4.5.5 Thu, 30 Oct 2025 10:49:30 GMT YARA v4.5.5 brings `--no-follow-symlinks` support to Windows. • Adds `--no-follow-symlinks` option on Windows, preventing YARA from following symbolic links during scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.5.1 https://github.com/VirusTotal/yara/releases/tag/v4.5.1 Sat, 25 May 2024 14:24:04 GMT YARA v4.5.1 allows spaces in regexp repetition operators like {n, m} • Allow spaces in regexp repetition operators (e.g: `{n, m}`) • BUGFIX: `matches` operator was not matching empty strings (c80cd9d). • BUGFIX: Several bugs in array type handling in `dotnet` module (#2064). • BUGFIX: Infinite loop while parsing corrupt PE files (e453eb1). • BUGFIX: OOM errors while parsing corrupt PE files (4b9b4c0, 1be111). • BUGFIX: Build issue in Alpine Linux due to `pread64` not found (#2050). • BUGFIX: Issue while parsing rich header in some PE files (4793b49). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.5.0 https://github.com/VirusTotal/yara/releases/tag/v4.5.0 Tue, 13 Feb 2024 11:40:20 GMT YARA v4.5.0 adds --disable-console-logs and --strict-escape flags, new pe.export_details RVA, and CALLBACK_MSG_TOO_SLOW_SCANNING • Adds `--disable-console-logs` command-line option to suppress console module output. • Adds `--strict-escape` command-line option to raise warnings on unknown escape sequences in rules. • Unreferenced strings are now allowed if their identifier starts with `_`. • Improves performance by avoiding execution of rule conditions that can't match. • New callback message `CALLBACK_MSG_TOO_SLOW_SCANNING` notifies users about slow rules. • Exposes the `RVA` function in the `pe.export_details` module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.3.0 https://github.com/VirusTotal/yara/releases/tag/v4.3.0 Mon, 27 Mar 2023 14:36:35 GMT YARA v4.3 adds XOR key printing, .NET user type parsing, ELF telfhash function, and loop improvements • Adds `--print-xor-key` (`-X`) CLI flag to output the XOR key for xored strings in rule matches • Implements Windows support for the existing `--skip-larger` command-line option • Adds parsing of .NET user types from the .NET metadata stream in the `dotnet` module • Adds telfhash() function to the `elf` module • Adds to_int() and to_string() functions to the `math` module • Allows `for` statements to iterate over sets of literal strings in hex rules • Enables `of` statement usage with `at` for positional matching Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.2.1 https://github.com/VirusTotal/yara/releases/tag/v4.2.1 Tue, 26 Apr 2022 09:11:14 GMT Adds `--skip-larger` option on Windows • Implement the `--skip-larger` command-line option in Windows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara https://github.com/VirusTotal/yara/releases/tag/v4.2.0 https://github.com/VirusTotal/yara/releases/tag/v4.2.0 Thu, 10 Mar 2022 15:18:19 GMT YARA v4.2.0 adds range-offset string matching, new operators (%, defined, iequals), math module functions, and process memory scanning controls. • Adds #a in (0..100) syntax for counting string occurrences within a range of offsets • Adds all of them in (0..100) syntax for checking if a set of strings are found within a range of offsets • Extends the `of` operator to accept sets of rules, supporting syntax like 2 of (rule1, rule2, rule3) or 2 of (rule*) • Adds none of ($a*) syntactic sugar as equivalent to 0 of ($a) • Adds new `%` operator for string sets, allowing usage like `20% of them` • Adds new `defined` operator • Adds new `iequals` operator • Adds `abs`, `count`, `percentage` and `mode` functions to the `math` module • Builds the `dotnet` module into YARA by default instead of requiring external loading • Adds `is_dotnet` field to the `dotnet` module output • Adds new `console` module for matching console-based payloads • Adds support for delayed imports in the `pe` module • Adds `yr_get_configuration_uintXX` and `yr_set_configuration_uintXX` API functions for runtime configuration management • Adds `--max-process-memory-chunk` option to control process memory scanning chunk size • Adds `--skip-larger` option to skip files exceeding a specified size during directory scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara